The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to the way it processes untrusted data.
Ingestion points: The skill reads arbitrary source code files, wiki entries, git logs, and search results as seen in the follow, investigate, and decompose subcommands (specifically in the A_COLLECT_EVIDENCE and A_BUILD_CONTEXT_WEB actions).
Boundary markers: Absent. While the skill defines 'Output boundaries' to restrict where it writes data, it does not utilize delimiters or 'ignore instructions' warnings when reading content from external codebases.
Capability inventory: The skill has access to powerful tools including Bash, Write, spawn_agent, and maestro delegate (which initiates a delegated analysis task).
Sanitization: Absent. There is no evidence of sanitization or escaping of the ingested code content before it is used to generate reports or drive automated investigations.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to interact with the maestro CLI and perform recursive searches across the filesystem. This is a functional requirement but constitutes a significant privilege within the execution context.
[DATA_EXPOSURE]: The skill accesses configuration and workflow files located in ~/.maestro/workflows/. Access to the user's home directory for configuration is standard for this framework but noteworthy as it spans beyond the local project directory.

learn